I could use some help with a hardware mod.

[The Robman]

I just got myself a Slingbox and I noticed that it has a UEI chip and EEPROM onboard
which it uses to control your devices, so being the hacker that I am, I decided to try
to install a 6-pin JP1 connector, which I did but unfortunately it doesn't work. So,
I'm posting the details about what I did here in case anyone can spot some stupid mistake
that I might have made. I took pictures as I went along with a view to creating a "how to"
web page, so you can all see what I did. I noticed that there is connectivity between the
EEPROM's Vdd pin (pin8) and the MCU's Vdd pin (pin5), which isn't usually the case with our
remotes. This means that once all the wires are connected, there is connectivity between
pin1 and pin2 of the 6-pin. I tried disconnecting the wire from the MCU's Vdd pin but that
didn't make a difference. So, anyone have any ideas?

First, here's where I connected each pin of the 6-pin:

pin
1 = MCU pin 5 (MCU Vdd)
2 = E2 pin 8 (E2 Vdd)
3 = ground
4 = E2 pin 5 (SDA)
5 = MCU pin 12 (reset)
6 = E2 pin 6 (SCL)

The following graphic is a snap shot from the datasheet for the S3C8 chip itself.



This pic shows the area of the Slingbox PCB where the UEI chip and EEPROM are located.
You can also see the 6 holes that I have drilled ready for the 6-pin.



This next pic shows the wires attached to the 6-pin and pulled through a nearby hole.



This is what it looks like from underneath.



This next pic shows the wires attached to the MCU and EEPROM.



Here is a schematic of the relevant parts:



The following pic is a large zoom-out shot that shows a much larger section of the PCB,
just in case you're interested.

http://www.hifi-remote.com/slingbox/zoom-out.jpg

[gjarboni]

Maybe this has already occurred to you, but looking at the simple interface instructions
(specifically the last paragraph), it seems that the simple interface depends on four
components on the remote's PCB: R37, R17, R19,& C11. R100 (3.3K) corresponds to
R19 (10k), C11 corresponds to CD39 (both 0.1uf), but I don't see an analog to R37 or
R17. The easiest thing to try would be to short reset to ground so the processor stays
in reset the whole time the cable is plugged into the remote. Hopefully that will make
up for the differences in the remote design.

[The Robman]

Thanks for the input Jason (I was hoping that somebody would throw something on the
fire). Actually, at the moment I am using a Simple interface and I've thought of
digging up one of my "Dan Classics" but haven't done so yet.

I'm certainly up for giving the rest-to-ground thing a try, I'll let you know how it
works out.

So, where's Tommy when you need him, eh? I've tried calling him too, but always get
his machine, so I'm guessing he's on vacation.

[The Robman]

For anyone else following this, here's the section of the Simple Interface
spec that Jason was referring to...

10. SCHEMATIC AND THEORY OF OPERATION
As shown in Figure 6, the RESET line is controlled directly by the D2 output of
the parallel port through resistor R2, which limits current into the reset pin
in case the remote is operating at a lower voltage than the computer. The SCL
line is controlled by the D1 output through resistor R1. The PC can send clock
signals through R1 to the EEPROM while the remote is reset, and the remote can
send clock signals to the EEPROM while the PC is holding D1 high and R1 acts as
a pull-up. The SDA line is controlled by the D0 output through the diode. When
D0 is high the diode is reverse biased. Under this condition the processor can
send and receive data to the EEPROM on the SDA line, and the EEPROM can send data
to the PC on the S7 line. When the processor output is in tri-state, a low on D0
will pull down on the SDA line through the diode, and a high will let R19 pull up
on it. That's the way the PC sends data to the EEPROM.


Figure 6. Schematic of Simple Interface Connected to Remote

[The Robman]

I can see that pins 1 and 2 of the 6-pin (which are shorted by the JP1 cable
to provide power to the EEPROM) are not needed as the EEPROMs Vdd and the MCUs
Vdd are connected via the PCB anyway.

I've been trying to compare Tommy's shematic to the various remote shcematics
that I've looked at, but this is proving tricky because the design seems to
keep changing from schematic to schematic.

[mr_d_p_gumby]

If I remember correctly, the S3C80s RESET input has an internal pullup built-in, so I don't
think reset is the problem. Many of the 6805 remotes have JP1 pins 1 & 2 connected together,
and that does not cause any problem.

I think you are fighting a voltage level problem. For example, the SDA and SCL lines have
3.3K pullup resistors. Even with 1K resistors in the simple interface, it won't be able to
pull the pins below about 0.8 volts, which might be right on the edge of the level required
for a logic low. You might try (carefully) a modified simple interface with 100 ohm resistors
instead of 1K. Alternatively, you could remove the 3.3K resistors from the Slingbox & replace
them with 10Ks.

Another possibility that occurs to me is that maybe the I2C connections go to other devices
besides the S3C8 & EEPROM.

[The Robman]

But don't most of our remotes run on about 3.3v also? Plus, when I first tried out my new
connector, I didn't have the Slingbox powered up. Someone else has suggested that I connect
a 100 ohm resistor between the EEPROM's Vdd (pin 8) and the P2.2 port (pin 44) of the MCU.

Regarding the voltage thing, I've always been curious about something. How does the Simple
interface work when there aren't any batteries in the remote (and there haven't been any
batteries in the remote for a while, so the main capacitor isn't charged up)?

[The Robman]

I tried using my powered "Dan Classic" interface and it didn't make a difference.

I also measured the resistance between certain key points:
1) R28 (ie, Vdd to P2.2) = 900 ohm (s/b 100 ohm)
2) R19 (ie, Vdd to SDA) = 600 ohm (s/b 10k)
3) R17 (ie, Vdd to RESET) = 600 ohm (s/b 1.1M)

[mtakahar]

But don't most of our remotes run on about 3.3v also?

Yeah, that's true to the supplied voltage but what Mike pointed out was about the 3.3k ohm resistors (R100 and R101) that makes the SCL/SDA pin voltages lower.

What's really missing to me is the R17 (the value for this should be really high). IIUC, s3c8 has to see a falling edge to go into the sleep mode. In the schematics, the reset doesn't seem to be connected to anywhere, but if that's the case, there will be no falling if it wasn't pulled up at the first place. (See p. 8-6 in the doc: http://www.samsung.com/Products/Semicon ... 9,G7,9.pdf)

What Mike suggested maybe still relevant, too.

Regarding the voltage thing, I've always been curious about something. How does the Simple
interface work when there aren't any batteries in the remote (and there haven't been any
batteries in the remote for a while, so the main capacitor isn't charged up)?

My understanding is that's the power from the parallel port supplied to the D1 and D2 pins.

Hal

[mtakahar]

I tried using my powered "Dan Classic" interface and it didn't make a difference.

I also measured the resistance between certain key points:
1) R28 (ie, Vdd to P2.2) = 900 ohm (s/b 100 ohm)
2) R19 (ie, Vdd to SDA) = 600 ohm (s/b 10k)
3) R17 (ie, Vdd to RESET) = 600 ohm (s/b 1.1M)

Rob, what you would really want to measure are the voltages. Try it both with this box and one of your remotes with and without the JP1 cable connected, also the moment you try to down/upload and compare the values (i.e.: SCL high/low, reset high/low, etc.)

Hal

[jherrick]

I tried using my powered "Dan Classic" interface and it didn't make a difference.

I also measured the resistance between certain key points:
1) R28 (ie, Vdd to P2.2) = 900 ohm (s/b 100 ohm)
2) R19 (ie, Vdd to SDA) = 600 ohm (s/b 10k)
3) R17 (ie, Vdd to RESET) = 600 ohm (s/b 1.1M)

Rob, what you would really want to measure are the voltages. Hal

Rob, one reason you might not be measuring correct resistance is that the resistors may not be right next to ground. Unless the resistor is the first component in the path, and there are no other components in parallel to it, you usually won't see the labeled resistance of the resistor on your meter. The resistors are often put in RC (not remote control; resistive capacitive) circuits or in parallel with something else.
Revealed: all this reference to resistance reverberates of redundancy, right? Sorry, couldn't "resist".

[mtakahar]

... also the moment you try to down/upload and compare the values (i.e.: SCL high/low, reset high/low, etc.)

You can use the debug command and directly manipulate state of each pin.

The parallel port base I/O address is the data port that colntrols D0-D2, and the base + 1 is the status port for ~S7.

You'll need to use allowio if you are using XP, etc. You may also need to set the compatibility to Windows 98/Me or 95 and turn off advanced text service in the Compatibility tab in the program settings. (allowio seems to screw up the key inputs on my PC if I don't turn it off.)

For example, 0x3bc is the base address in my PC, so I would create .bat file would look like this:

allowio 0x3bc 0x3bd debug

Right-click on this batch file, set the compatibility settings and run it.

Then use the "i" and "o" commands to read from/write to the port. "o 3bc 7" will set SDA (01), SCL (02) and RESET (04) all high. From this state, "o 3bc 3" will pull down RESET and the remote should go to sleep if the voltage between ground-RESET has transitioned from high "enough" value to low "enough".

Be carefull when you play with the SDA and SCL pins so you don't overwrite contents of the EEPROM.

Hal

[The Robman]

Changing resistors R100 and R101 from 3.3k to 10k seems to have done the trick.

[mr_d_p_gumby]

Changing resistors R100 and R101 from 3.3k to 10k seems to have done the trick.

8) Glad my suggestion worked out OK, even from this distance (China).

[The Robman]

Indeed. Hey, while you're there, you should stock up on parts 'n' stuff for remotes, because they all come from there!